Search the Community

Este un UDP flooder ce se bazeaza pe surse shell. am dat 10e pe el, acum o sa-l fac public editat Am zis sa il impart cu voi de pasti:)

Salut am de facut un mini paint la facultate . Creati un editor grafic simplu, cu 3 butoane: de adaugare in fereastra a unui cerc, de adaugare a unui patrat si de stergere a unei forme (cerc sau patrat) -forma ce se poate selecta cu mouse-ul. /** * Created by on 4/6/2015. */ import javax.swing.*; import java.awt.*; import java.awt.event.ActionEvent; import java.awt.event.ActionListener; import java.awt.event.MouseEvent; import java.awt.event.MouseListener; import java.awt.geom.Ellipse2D; import java.util.ArrayList; /** * Created by Angheluta on 4/6/2015. */ public class Main extends JFrame implements ActionListener,MouseListener{ JButton b1; JButton b2; JButton b3; int x,y,x1,y1; int x3,y3; String nume=" "; ArrayList<Dreptunghi> dreptunghis = new ArrayList<Dreptunghi>(); ArrayList<cerc> cercs =new ArrayList<cerc>(); public Main(){ b1 =new JButton("Dreptunghi"); b1.setBounds(10,20,100,20); b1.addActionListener(this); b2 =new JButton("Cerc"); b2.setBounds(120,20,100,20); b2.addActionListener(this); b3 =new JButton("Sterge"); b3.setBounds(220,20,100,20); b3.addActionListener(this); addMouseListener(this); add(b1); add(b2); add(b3); setLayout(null); setSize(600,600); setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE); setVisible(true); } public void paint(Graphics g) { if(nume.equals("Dreptunghi")) { for (Dreptunghi d : dreptunghis) { d.paint(g); } } if(nume.equals("Cerc")) { for(cerc c : cercs) { c.paint(g); } } } @M2G

Subject: Cisco UCSM username and password hashes sent via SYSLOG Impact: Information Disclosure / Privilege Elevation Vendor: Cisco Product: Cisco Unified Computing System Manager (UCSM) Notified: 2014.10.31 Fixed: 2015.03.06 ( 2.2(3e) ) Author: Tom Sellers ( tom at fadedcode.net ) Date: 2015.03.21 Description: ============ Cisco Unified Computing System Manager (UCSM) versions 1.3 through 2.2 sends local (UCSM) username and password hashes to the configured SYSLOG server every 12 hours. If the Fabric Interconnects are in a cluster then each member will transmit the data. SYSLOG Example ( portions of password hash replaced with <!snip!> ): Oct 28 23:31:37 xxx.Xxx.xxx.242 : 2014 Oct 28 23:49:15 CDT: %USER-6-SYSTEM_MSG: checking user:User1,$1$e<!snip!>E.,-1.000000,16372.000000 - securityd Oct 28 23:31:37 xxx.Xxx.xxx.242 : 2014 Oct 28 23:49:15 CDT: %USER-6-SYSTEM_MSG: checking user:admin,$1$J<!snip!>71,-1.000000,16372.000000 - securityd Oct 28 23:31:37 xxx.Xxx.xxx.242 : 2014 Oct 28 23:49:15 CDT: %USER-6-SYSTEM_MSG: checking user:samdme,!,-1.000000,16372.000000 - securityd Vulnerable environment(s): ========================== Cisco Unified Computing System Manager (UCSM) is a Cisco product that manages all aspects of the Unified Computing System (UCS) environment including Fabric Interconnects, B- Series blades servers and the related blade chassis. C-Series (non-blade) servers can also be managed. These solutions are deployed in high performance / high density compute solutions and allow for policy based and rapid deployment of resources. They are are typically found in Data Center class environments with 10/40 GB network and 8/16 GB Fibre Channel connectivity. Software Versions: 1.3 - 2.2(1b)A Hardware: Cisco 6120 XP, 6296 UP SYSLOG Configuration: - Level: Information - Facility: Local7 - Faults: Enabled - Audits: Enabled - Events: Disabled Risks: ====== 1. Individuals who have access to the SYSLOG logs may not be authorized to have access to the UCSM environment and this information represents an exposure. 2. Authorized users with the 'Operations' roles can configure SYSLOG settings, capture hashes, crack them, and elevate access to Administrator within the UCSM. 3. SYSLOG is transmitted in plain text. Submitter recommendations to vendor: ==================================== 1. Remove the username and password hash data from the SYSLOG output. 2. Allow the configuration of the SYSLOG destination port to enable easier segmentation of SYSLOG data on the log aggregation system. 3. Add support for TLS wrapped SYSLOG output. Vendor response/resolution: ========================== After being reported on October 30, 2014 the issue was handed from Cisco PSIRT to internal development where it was treated as a standard bug. Neither the PSIRT nor Cisco TAC were able to determine the status of the effort other than it was in progress with an undetermined release date. On March 6, 2015 version 2.2(3e) of the UCSM software bundle was released and the release notes contained the following text: --- Cisco UCS Manager Release 1.3 through Release 2.2 no longer sends UCS Manager username and password hashes to the configured SYSLOG server every 12 hours. --- For several weeks a document related to this issue could be found in the Cisco Security Advisories, Responses, and Alerts site [1] but this has since been removed. Documents detailing similar issues [2] have been released but none reference the Bug/Defect ID I was provided and the affected versions do not match. The following documents remain available: Public URL for Defect: https://tools.cisco.com/quickview/bug/CSCur54705 Bug Search (login required): https://tools.cisco.com/bugsearch/bug/CSCur54705 Release notes for 2.2(3e): http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/release/notes/ucs_2_2_rn.html#21634 Associated vendor IDs: PSIRT-1394165707 CSCur54705 Timeline: ============ 2014.10.30 Reported to psirt@cisco.com 2014.11.04 Response from PSIRT, assigned PSIRT-1394165707 2014.11.06 Follow up questions from Cisco, response provided same day 2014.11.12 Status request. PSIRT responded that this had been handed to development and assigned defect id CSCur54705. 2014.12.04 As PSIRT doesn't own the bug any longer, opened TAC case requesting status. 2014.12.10 Response from Cisco TAC indicating that perhaps I should upgrade to the latest version at that time 2014.12.12 Discussion with TAC, unable to gather required status update internally, TAC case closed with my permission 2015.02.04 Internal Cisco updates to the public bug document triggered email notification, no visible changes to public information 2015.02.05 Sent status update request to PSIRT, response was that bug was fixed internally, release pending testing, release cycle, etc. 2015.02.11 Follow up from Cisco to ensure that no additional information was required, closure of my request with my permission 2015.02.13 Internal Cisco updates to the public bug document triggered email notification, no visible changes to public information 2015.03.04 Internal Cisco updates to the public bug document triggered email notification, no visible changes to public information 2015.03.06 Update to public bug document, indicates that vulnerability is fixed in 2.2(3e) Reference: 1 - http://tools.cisco.com/security/center/publicationListing.x 2 - http://tools.cisco.com/security/center/viewAlert.x?alertId=36640 ( CVE-2014-8009 ) Source

Internet traffic for 167 important British Telecom customers—including a UK defense contractor that helps deliver the country's nuclear warhead program—were mysteriously diverted to servers in Ukraine before being passed along to their final destination. The snafu may have allowed adversaries to eavesdrop on or tamper with communications sent and received by the UK's Atomic Weapons Establishment, one of the affected British Telecom customers. Other organizations with hijacked traffic include defense contractor Lockheed Martin, Toronto Dominion Bank, Anglo-Italian helicopter company AgustaWestland, and the UK Department for Environment, according to a blog post published Friday by researchers from Dyn, a firm that helps companies monitor and control their online infrastructure. The diverted traffic appeared to be used to send e-mail and route virtual private networks, as well as for other purposes. As the picture above illustrates, the roundabout path caused the data to travel thousands of miles to the Ukrainian capital of Kiev before turning around, retracing that route, and being delivered to its normal hub in London. Unnecessarily sending the data to Kiev may have made it possible for employees with privileged network access to Ukrainian telecom provider Vega to monitor or tamper with data that wasn't encrypted end-to-end using strong cryptography. The hijacking of the Atomic Weapons Establishment, Lockheed, and the other 165 routes occurred over a 90-minute span on Thursday, while a handful of British Telecom customers experienced diverted traffic for five days beginning Saturday. "The 167 hijacked prefixes (listed below) also included more innocuous networks like those of Pepsi Cola (165.197.56.0/22) and Wal-Mart UK (161.163.166.0/24 and 161.163.177.0/24)," Dyn Director of Internet analysis Doug Madory wrote. "However, these networks do host domains with 'VPN' and 'mail' in their names, implying they provide important services for these companies. Does this list represent some curious mistake or something more? Either way, it redirected a portion of Internet traffic bound for networks, at a minimum resulting in poor performance for some customers." It's not the first time that significant chunks of Internet traffic have been diverted to distant locations for unexplained reasons. In late 2013, Dyn researchers reported that data belonging to financial institutions, government agencies, and network service providers were mysteriously redirected to routers at Belarusian or Icelandic service providers. The hijackings occurred during at least 38 distinct events over a nine-month span that began in February of that year. The diversions are the result of the implicit trust placed in the border gateway protocol used to exchange data between large service providers and their customers, which include financial institutions, governments, network service providers, pharmaceutical and aerospace companies, and other sensitive organizations. As Ars explained in November, 2013: The full list of 167 customers affected is: 212.162.232.0/24 Cofunds Ltd (GB) 148.253.220.0/23 Department for Environment, Food and Rural Affairs (DEFRA) (GB) 61.28.211.0/24 Servcorp (GB) 86.128.0.0/11 BT Infrastructure Layer (GB) 86.128.0.0/12 BT Infrastructure Layer (GB) 193.32.254.0/24 Marks and Spencer PLC (GB) 194.70.94.0/24 Dabs Direct PLC (GB) 148.252.5.0/24 Department for Environment, Food and Rural Affairs (DEFRA) (GB) 37.235.123.0/24 Submission Technology Ltd (GB) 194.169.34.0/24 AgustaWestland Ltd (GB) 81.128.0.0/12 BT Infrastructure Layer (GB) 143.159.0.0/16 INFONET Services Corporation (GB) 147.148.0.0/14 Various Registries (Maintained by ARIN) (GB) 193.46.221.0/24 Continental DataGraphics Ltd (GB) 132.153.3.0/24 Atomic Weapons Establishment (GB) 194.169.69.0/24 BUILDING DESIGN PARTNERSHIP LIMITED (GB) 91.230.16.0/24 Dairy Crest Ltd (GB) 193.32.48.0/24 Virgin Money plc (GB) 193.36.240.0/24 Allen and Overy LLP (GB) 192.19.187.0/24 Avago Technologies U.S. Inc. (GB) 31.48.0.0/13 BT Public Internet Service (GB) 195.171.0.0/16 BT Public Internet Service (GB) 132.153.254.0/24 Atomic Weapons Establishment (GB) 213.120.0.0/14 BT Public Internet Service (GB) 91.223.126.0/24 Evolving Systems Limited (GB) 116.66.140.0/22 Cognizant Technology Solution India Pvt Ltd, India (GB) 81.128.0.0/11 BT Public Internet Service (GB) 195.182.62.0/24 The Football Association Ltd (GB) 185.30.8.0/22 Satellite Applications Catapult Limited (GB) 86.128.0.0/10 BT Public Internet Service (GB) 147.152.0.0/16 British Telecommunications PLC (GB) 162.62.136.0/22 Adaptec, Inc. (GB) 193.28.232.0/24 TEVA UK HOLDINGS LIMITED (GB) 193.238.232.0/24 Pinewood Technologies Plc (GB) 194.36.55.0/24 Hogg Robinson PLC (GB) 196.4.50.0/24 Uniserv Group (GB) 194.33.160.0/24 Office of Communications (GB) 161.163.177.0/24 Wal-Mart Stores, Inc. (GB) 194.130.197.0/24 MAID PLC (GB) 192.65.44.0/24 Tektronix, Inc. (GB) 192.189.160.0/24 Lafarge Tarmac Holdings Limited (GB) 132.153.252.0/24 Atomic Weapons Establishment (GB) 193.195.138.0/24 Telme Online Limited (GB) 193.33.244.0/24 AAH Pharmaceuticals Ltd (GB) 132.153.251.0/24 Atomic Weapons Establishment (GB) 198.200.211.0/24 Curtis Instruments, Inc. (GB) 193.46.76.0/24 Shire Pharmaceuticals Limited (GB) 144.98.0.0/16 RWE NPower (GB) 84.23.0.0/19 Biznet IIS Ltd. (GB) 158.234.0.0/16 CGI IT UK Ltd. (GB) 193.35.197.0/24 British Telecommunications PLC (GB) 194.60.136.0/24 Cornwall Council (GB) 146.174.170.0/23 Quantum Corporation (GB) 167.26.157.0/24 CIBC World Markets (GB) 109.205.158.0/24 BONTBLOCK (GB) 5.81.0.0/16 BT Infrastructure Layer (GB) 162.10.0.0/19 Doculynx Inc. (GB) 158.155.253.0/24 Computer Generation (GB) 165.197.56.0/22 Pepsi-Cola International (GB) 193.37.142.0/24 CSC IT Ltd (GB) 148.252.3.0/24 Department for Environment, Food and Rural Affairs (DEFRA) (GB) 193.113.0.0/16 British Telecommunications PLC (GB) 194.36.248.0/24 WWRD United Kingdom Ltd (GB) 193.37.160.0/24 BT Public Internet Service (GB) 91.198.255.0/24 Sandwell Metropolitan Borough Council (GB) 192.65.227.0/24 British Telecommunications PLC (GB) 5.53.64.0/19 SAS Global Communications Ltd. (GB) 132.153.244.0/24 Atomic Weapons Establishment (GB) 170.136.115.0/24 Viad Corp (GB) 194.59.188.0/24 WCMC 2000 (GB) 194.132.25.0/24 WSP Europe (GB) 195.99.0.0/16 BT Public Internet Service (GB) 192.152.14.0/24 Aircraft Research Association Limited (GB) 159.10.208.0/22 CNA Insurance (GB) 199.181.156.0/24 ARC - Chicago (GB) 132.153.246.0/24 Atomic Weapons Establishment (GB) 192.65.224.0/24 British Telecommunications PLC (GB) 94.72.248.0/21 KCOM BT sub-allocation (GB) 193.238.233.0/24 Pinewood Technologies Plc (GB) 193.219.122.0/24 Significant (UK) Ltd (GB) 80.247.56.0/23 PGDS UK ONE - BT Internet - PG1 DC (GB) 192.65.228.0/24 British Telecommunications PLC (GB) 192.65.226.0/24 British Telecommunications PLC (GB) 194.169.32.0/24 AgustaWestland Ltd (GB) 204.124.211.0/24 Fruit of the Loom, Inc. (GB) 194.169.32.0/20 AgustaWestland Ltd (GB) 148.253.4.0/22 Department for Environment, Food and Rural Affairs (DEFRA) (GB) 194.132.24.0/24 WSP Europe (GB) 194.169.22.0/24 Isoft Health Ltd (GB) 132.153.247.0/24 Atomic Weapons Establishment (GB) 194.34.174.0/24 Allianz Insurance plc (GB) 161.163.166.0/24 Wal-Mart Stores, Inc. (GB) 195.8.202.0/23 Significant (UK) Ltd (GB) 192.31.31.0/24 British Telecommunications PLC (GB) 192.28.124.0/24 Lockheed Martin Corporation (GB) 212.140.0.0/16 BT Public Internet Service (GB) 193.195.7.0/24 Thus PLC t/a Demon Internet (GB) 192.19.199.0/24 Avago Technologies U.S. Inc. (GB) 91.233.33.0/24 Metropolitan Networks UK Ltd (GB) 192.65.222.0/24 British Telecommunications PLC (GB) 159.180.96.0/19 BT-CENTRAL-PLUS (GB) 165.120.0.0/16 BT Public Internet Service (GB) 155.202.124.0/22 SANTANDER UK PLC (GB) 150.147.68.0/24 Data Research Associates, Inc. (GB) 132.146.0.0/16 British Telecommunications PLC (GB) 109.144.0.0/12 BT Public Internet Service (GB) 159.253.66.0/23 KCOM Group Public Limited Company (GB) 142.205.161.0/24 Toronto Dominion Bank (GB) 62.7.0.0/16 BT Public Internet Service (GB) 62.239.0.0/16 British Telecommunications PLC (GB) 194.36.128.0/24 Hitachi Europe Ltd (GB) 194.32.3.0/24 Northern Ireland Civil Service (GB) 170.136.116.0/24 Viad Corp (GB) 217.32.0.0/12 BT Public Internet Service (GB) 192.65.219.0/24 British Telecommunications PLC (GB) 194.169.33.0/24 AgustaWestland Ltd (GB) 213.1.0.0/16 BT Public Internet Service (GB) 62.6.0.0/16 BT Public Internet Service (GB) 5.80.0.0/15 BT Public Internet Service (GB) 195.244.16.0/24 Websense SC Operations Limited (GB) 91.227.78.0/24 Ashridge (Bonar Law Memorial) Trust (GB) 194.169.36.0/24 AgustaWestland Ltd (GB) 193.131.115.0/24 Eurodollar (UK) Limited (GB) 192.65.223.0/24 British Telecommunications PLC (GB) 212.70.68.0/23 Intuitiv Ltd. (GB) 194.169.79.0/24 BUILDING DESIGN PARTNERSHIP LIMITED (GB) 132.153.250.0/24 Atomic Weapons Establishment (GB) 80.247.0.0/20 Net Energy Internet Ltd. (GB) 195.35.123.0/24 Toshiba Information Systems (UK) Ltd (GB) 194.130.196.0/24 MAID PLC (GB) 194.34.211.0/24 The Statistics Board (GB) 85.235.107.0/24 DMZ at Bacton. (GB) 146.198.0.0/16 INFONET Services Corporation (GB) 82.132.188.0/22 O2 Reference (UK) (GB) 194.72.0.0/14 BT Public Internet Service (GB) 213.249.188.0/22 KCOM Group Public Limited Company (GB) 194.34.210.0/24 The Statistics Board (GB) 194.34.205.0/24 The Statistics Board (GB) 192.65.225.0/24 British Telecommunications PLC (GB) 132.153.245.0/24 Atomic Weapons Establishment (GB) 132.153.253.0/24 Atomic Weapons Establishment (GB) 132.153.249.0/24 Atomic Weapons Establishment (GB) 162.116.126.0/24 Allergan, Inc. (GB) 91.247.73.0/24 Unipath Limited (GB) 145.229.0.0/16 Northern Ireland Civil Service (GB) 192.65.221.0/24 British Telecommunications PLC (GB) 149.223.0.0/16 TRW Automotive (GB) 194.169.35.0/24 AgustaWestland Ltd (GB) 167.26.158.0/24 CIBC World Markets (GB) 159.197.13.0/24 NATS (GB) 62.172.0.0/16 BT Public Internet Service (GB) 212.162.230.0/24 Royal Bank of Scotland plc (GB) 216.222.222.0/24 Smith and Nephew - Endoscopy (GB) 193.102.37.0/24 Softlab GmbH, Muenchen (GB) 194.102.0.0/19 British Telecommunications PLC (GB) 193.32.39.0/24 Sir Robert McAlpine Ltd (GB) 192.156.169.0/24 Syntellect Inc. (GB) 171.30.128.0/17 Global Crossing VHSDR service (GB) 132.153.248.0/24 Atomic Weapons Establishment (GB) 194.34.209.0/24 The Statistics Board (GB) 193.36.253.0/24 Allen and Overy LLP (GB) 195.95.131.0/24 NCC Services Ltd (GB) 152.134.0.0/16 SIX CONTINENTS LIMITED (GB) 61.28.219.0/24 Servcorp (GB) 194.34.223.0/24 Allianz Insurance plc (GB) 167.26.159.0/24 CIBC World Markets (GB) 193.39.141.0/24 AWE PLC (GB) A chart provided by Dyn showed that about a quarter of the Internet's large providers observed the roundabout path advised for Royal Mail Group, Limited, one of 14 groups with hijacked traffic that started Saturday. Well under 10 percent of large Internet providers observed the circuitous route Vega advised for the Atomic Weapons Establishment during the much shorter 90-minute window that diversion lasted. It's not clear if a similarly small portion of providers recognized the path advertised for the other 166 BT customers affected. Still, the diversion is significant given the number and stature of those customers. Source

Google has adjusted the terms of its controversial Project Zero vulnerability scouting effort, loosening its 90-day disclosure policy somewhat to give companies a better chance of fixing their security bugs before they become public knowledge. Among the changes, Google says it will no longer disclose bugs on weekends and public holidays, and it will even offer software vendors a brief grace period to finish their patches, if they request one. Project Zero has drawn fire from software companies – most notably Microsoft – for disclosing critical vulnerabilities to the public exactly 90 days after it reports them to vendors, a policy that top Redmond security bod Chris Betz said "feels less like principles and more like a 'gotcha'." "What's right for Google is not always right for customers," Betz wrote in a blog post in January. "We urge Google to make protection of customers our collective primary goal." Mind you, it's only natural that Microsoft would be miffed. Among the bugs revealed by Project Zero so far are critical zero-day flaws in Windows that can potentially allow an attacker to gain full control of affected systems. Google's vulnerability disclosures often include proof-of-concept exploit code, meaning cyber-crooks have access to working exploits the minute Google's disclosure goes live. Still, Google seems to have heard Redmond's complaints. On Friday, the online ad-slinger said it would make changes to how Project Zero discloses flaws, but it stopped short of saying it would lengthen the 90-day deadline, noting that CERT's own deadline is even shorter. "We notify vendors of vulnerabilities immediately, with details shared in public with the defensive community after 90 days, or sooner if the vendor releases a fix," Google's security team wrote in a blog post. "We've chosen a middle-of-the-road deadline timeline and feel it's reasonably calibrated for the current state of the industry." Going forward, however, 90 days won't necessarily mean 90 days. For one thing, if the date of a patch disclosure deadline falls on a weekend or a public holiday, Google now says it will hold off on its disclosure until the next working day. What's more, the Chocolate Factory says it will extend the disclosure deadline by a grace period of up to 14 days, provided a vendor lets it know that a patch will be released on a specific date within the 14 days. "Public disclosure of an unpatched issue now only occurs if a deadline will be significantly missed," Google's post states. Google says it will also be sure to pre-assign CVE (Common Vulnerabilities and Exposure) numbers to bugs that go past their deadlines before it discloses them, to avoid confusion and help the public understand specific threats. But Redmond wasn't entirely satisfied with the changes, saying it would much rather see Google work more interactively with software vendors to apply patches. "When finders release proof-of-concept exploit code, or other information publically before a solution is in place, the risk of attacks against customers goes up," Microsoft's Betz told The Register in an emailed statement. "While it is positive to see aspects of disclosure practices adjust, we disagree with arbitrary deadlines because each security issue is unique and end-to-end update development and testing time varies." Google, meanwhile, said that an arbitrary deadline, albeit a nondiscriminatory one, is the best vendors can hope for. "As always, we reserve the right to bring deadlines forwards or backwards based on extreme circumstances," Google's security team said. "We remain committed to treating all vendors strictly equally." ® Sursa

Table of Contents I. INTRODUCTION...............................................................................................................................1 II. BACKGROUND .............................................................................................................................2 Operation of a Biometric System: .........................................................................................................2 DNA:.....................................................................................................................................................4 Face Recognition:................................................................................................................................4 Hand and Finger Geometry:..............................................................................................................4 Fingerprint: .........................................................................................................................................4 Iris: .......................................................................................................................................................4 Retinal scan: ........................................................................................................................................5 III. DECIDING TO USE A BIOMETRIC TECHNOLOGY............................................................5 IV. CHALLENGES FACED................................................................................................................8 Privacy and Public Confidence: ............................................................................................................8 Fake Biometrics: .....................................................................................................................................9 Theft of Biometric Data: ........................................................................................................................9 Ease of Use:..............................................................................................................................................9 Environmental Factors:........................................................................................................................10 Physical Factors:...................................................................................................................................10 V. SOLUTIONS .....................................................................................................................................11 Educating Public about Biometrics – Solves Public Acceptance and Ease of Use problem: .........11 Testing the liveliness of a Biometric – Eliminates Fake Biometrics:................................................12 Encryption, Centralization, Multimodal Biometrics and Revising Algorithms – Solves the Problem of Theft:..................................................................................................................................12 Ensuring Cleanliness before using a Biometric Device – Mitigates Environmental Factors:........13 Solving the problem of Physical factors:.............................................................................................13 VI. CONCLUSION .............................................................................................................................14 REFERENCES..........................................................................................................................................15 Source